Azure Backup for AKS Silent Fix: Hardening and Detection Guide

---
title: Potential Azure Backup Extension Privilege Escalation
id: a1b2c3d4-5678-90ab-cdef-1234567890ab
status: experimental
description: Detects attempts to assign overly permissive roles to the Azure Backup extension identity or suspicious access patterns consistent with the reported vulnerability.
references:
  - https://www.bleepingcomputer.com/news/security/microsoft-rejects-critical-azure-vulnerability-report-no-cve-issued/
author: Security Arsenal
date: 2024/05/23
tags:
  - attack.privilege_escalation
  - attack.t1078.004
logsource:
  product: azure
  service: azureactivity
detection:
  selection:
    OperationName|contains:
      - 'microsoft.authorization/roleAssignments/write'
    RequestBody|contains:
      - 'AzureBackup'
      - 'BackupExtension'
  condition: selection
falsepositives:
  - Legitimate administrative configuration of Azure Backup
level: high
---
title: Azure AKS Backup Cross-Namespace Access
id: b2c3d4e5-6789-01ab-cdef-2345678901bc
status: experimental
description: Detects unusual restore operations on AKS clusters that may indicate abuse of the backup extension's permissions.
references:
  - https://www.bleepingcomputer.com/news/security/microsoft-rejects-critical-azure-vulnerability-report-no-cve-issued/
author: Security Arsenal
date: 2024/05/23
tags:
  - attack.collection
  - attack.t1005
logsource:
  product: azure
  service: azureactivity
detection:
  selection:
    OperationName|contains:
      - 'microsoft.dataprotection/backupinstances/restore'
      - 'microsoft.kubernetesconfiguration/extensions/write'
  filter:
    CallerIpAddress|startswith:
      - '192.168.' # Internal IP ranges (example)
      - '10.0.'
  condition: selection and not filter
falsepositives:
  - Scheduled backup restores by authorized administrators
level: medium

// Hunt for suspicious role assignments related to Azure Backup extensions
AzureActivity
| where OperationNameValue has "microsoft.authorization/roleAssignments/write"
| extend Properties = parse_(Properties)
| where tostring(Properties.scope) has "Microsoft.ContainerService/managedClusters"
| where tostring(Properties.properties) has "AzureBackup" or tostring(Properties.properties) has "aks-extension"
| project TimeGenerated, Caller, CallerIpAddress, OperationName, Properties, _ResourceId
| order by TimeGenerated desc

// Hunt for unexpected Backup Restore operations
AzureActivity
| where OperationNameValue has "microsoft.dataprotection/backupinstances" or OperationNameValue has "microsoft.kubernetesconfiguration/extensions"
| where Category == "Administrative"
| project TimeGenerated, Caller, OperationName, ActivityStatusValue, _ResourceId
| where ActivityStatusValue == "Success"
| order by TimeGenerated desc

-- Hunt for backup-related pods running with excessive privileges or suspicious mounts
SELECT Pod.Name, Pod.Namespace, Container.Name, Container.Image, Container.Command
FROM kube_pod_info()
WHERE Pod.Name =~ "backup" OR Pod.Labels =~ "extension"
  -- Check for hostPath mounts which are risky
  OR Container.VolumeMounts.MountPath =~ "host"
  -- Check for privileged containers
  OR Container.SecurityContext.Privileged = true

#!/bin/bash
# Azure Backup AKS Remediation & Verification Script
# Usage: az login required before running

CLUSTER_RESOURCE_GROUP=$1
CLUSTER_NAME=$2

if [ -z "$CLUSTER_RESOURCE_GROUP" ] || [ -z "$CLUSTER_NAME" ]; then
  echo "Usage: ./fix_aks_backup.sh <ResourceGroup> <ClusterName>"
  exit 1
fi

echo "[+] Checking Azure Backup Extension Status for AKS Cluster: $CLUSTER_NAME"

# List extensions to identify the Azure Backup extension
az aks extension list \
  --resource-group $CLUSTER_RESOURCE_GROUP \
  --cluster-name $CLUSTER_NAME \
  --query "[?name=='AzureBackupExtension']" \
  -o table

echo "[+] Verifying Extension Version..."
EXTENSION_VERSION=$(az aks extension show \
  --resource-group $CLUSTER_RESOURCE_GROUP \
  --cluster-name $CLUSTER_NAME \
  --name AzureBackupExtension \
  --query "version" -o tsv)

echo "Current Version: $EXTENSION_VERSION"

echo "[+] Checking for ClusterRoleBindings associated with Azure Backup..."
# This requires kubectl to be configured for the cluster
# Ensure you have credentials: az aks get-credentials -n $CLUSTER_NAME -g $CLUSTER_RESOURCE_GROUP

if command -v kubectl &> /dev/null; then
  kubectl get clusterrolebindings -o  | jq '.items[] | select(.metadata.name | contains("backup" or "Azure")) | {name: .metadata.name, roleRef: .roleRef.name, subjects: .subjects}'
else
  echo "kubectl not found. Skipping RBAC check."
fi

echo "[+] Recommendation: Ensure 'Automatic Upgrade' is enabled on the extension."
echo "Run the following command if auto-upgrade is disabled:"
echo "az aks extension update --resource-group $CLUSTER_RESOURCE_GROUP --cluster-name $CLUSTER_NAME --name AzureBackupExtension --auto-upgrade-minor-version true"